From fc1307df9b1a19691d62a881f62e066bf6d07cbf Mon Sep 17 00:00:00 2001 From: cliffhall Date: Mon, 5 Oct 2026 01:20:10 -0400 Subject: [PATCH] docs(agents): state the dep-lockstep rule the guard enforces The Dependencies bullet said shared devDependency ranges "already differ; do not widen the skew". Since #4864, verify:dep-lockstep (in validate:guards, so in CI) requires one identical range everywhere a SHARED_DEV_DEPENDENCIES package is declared. State that rule and name the guard. The issue's second item, the "with coverage" annotation on npm test, was already fixed by f149a2a6. Refs #4924 Co-Authored-By: Claude Opus 5.5 Signed-off-by: cliffhall --- AGENTS.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 16c7fb86c9..7a7e968214 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -181,8 +181,9 @@ than `GITHUB_TOKEN`. Today that is `release.yml`'s publish jobs and upward escape by silently downgrading. - **When you bump a devDependency that several TypeScript workspaces declare** (`typescript`, `vitest`, `@vitest/coverage-v8`, `@types/node`, …), bump it in - every workspace that declares it. Their ranges already differ; do not widen the - skew. + every workspace that declares it, with one identical range everywhere. The + `verify:dep-lockstep` guard (in `validate:guards`, so in CI) fails when two + declarations of a package in its `SHARED_DEV_DEPENDENCIES` list differ. - **A Python dependency change updates that server's `uv.lock`** in the same commit (`uv lock`). CI installs with `--frozen` / `--locked` and fails on a stale lockfile.